---
date: 2027-06-20
topic: Quarterly Government & Classified Infrastructure Risk Review (Q2 2027)
session_type: deliberation
moderator: Arthur Vance
court_reporter: Eleanor Vance
rounds: 2
updates: mvap/ZERO-DAY-OPEN-SOURCE-RISK-ASSESSMENT.md v2.0
---

# Quarterly Government Risk Review — Q2 2027

**Eleanor Vance:** Q2 living register update. Concurrent with MVAP v1.2 adoption.

---

## Round 1 — Status Assessment

| Risk ID | Q2 Status | Change from Q1 |
|---------|-----------|----------------|
| GOV-01 | ONGOING | No change — still no Senate-confirmed CISA director |
| GOV-02 | ONGOING Critical+ | GAO-26-107861 recommendations remain Open |
| GOV-03 | ONGOING | FBI Q2 briefings confirm Salt Typhoon persistence |
| GOV-04 | ONGOING | MS-ISAC gap widening; state ISACs backfilling partially |
| GOV-09 | PARTIAL | EO 14409 clearinghouse partially operational; patch lag |
| GOV-10 | ONGOING | NVD backlog unchanged; P7-08 redundancy validated |
| GOV-11 | MITIGATED | No new LiteLLM-class KEV; P7-11 audit PASS (18/27 orgs) |
| GOV-12 | MITIGATED | P7-09/P7-11 transitive dep controls deployed |
| GOV-13 | ONGOING | Contractor spill-to-RAG pattern unchanged |

**Sarah Jenkins:** P7-08 redundant feeds caught two GitHub Advisories before NVD publication this quarter.

**Marcus Thorne:** GOV-02 Critical+ — defense subcontractors cannot wait for DCSA inspection recovery.

---

## Round 2 — Register Reaffirmation

**Vote:** Risk register v2.0 reaffirmed **20/27**.

**Next review:** 2027-09-20 (Q3).

**Arthur Vance:** Study Chapter 6.9 updated. Mitigation strategy report to reference GOV-02 and GOV-13 as highest residual enterprise risk.